ambitry 0.1.0

package/dist/secrets.js

@@ -0,0 +1,129 @@
+/**
+ * Detecting credentials and personal data in outgoing prompts.
+ *
+ * Everything here runs locally and only ever reports *that* something was
+ * found, plus a masked preview. The secret itself is never written to the
+ * trace store — a tool that logs the credentials it catches has moved the
+ * leak rather than closed it.
+ *
+ * The design bias throughout is against false positives. A detector that
+ * fires on ordinary text gets muted within a day, and a muted detector is
+ * worth less than none at all because it also buys false confidence.
+ */
+/** Mask a secret down to something recognisable but unusable. */
+function mask(value) {
+    if (value.length <= 12)
+        return `${value.slice(0, 2)}${'•'.repeat(6)}`;
+    return `${value.slice(0, 4)}${'•'.repeat(8)}${value.slice(-4)}`;
+}
+/** Luhn check — without it, any 16-digit order number reads as a card. */
+function luhn(digits) {
+    let sum = 0;
+    let double = false;
+    for (let i = digits.length - 1; i >= 0; i--) {
+        let d = digits.charCodeAt(i) - 48;
+        if (double) {
+            d *= 2;
+            if (d > 9)
+                d -= 9;
+        }
+        sum += d;
+        double = !double;
+    }
+    return sum % 10 === 0;
+}
+/** Shannon entropy in bits per character. */
+function entropy(value) {
+    const freq = new Map();
+    for (const ch of value)
+        freq.set(ch, (freq.get(ch) ?? 0) + 1);
+    let bits = 0;
+    for (const n of freq.values()) {
+        const p = n / value.length;
+        bits -= p * Math.log2(p);
+    }
+    return bits;
+}
+const RULES = [
+    // Vendor-prefixed keys. These carry their own namespace, so a match is
+    // near-certain and worth flagging as critical.
+    { kind: 'AWS access key ID', severity: 'critical', pattern: /\bAKIA[0-9A-Z]{16}\b/g },
+    { kind: 'GitHub token', severity: 'critical', pattern: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g },
+    // The lookahead matters: Anthropic keys are `sk-ant-…`, so without it every
+    // Anthropic key is also reported as an OpenAI one.
+    { kind: 'OpenAI API key', severity: 'critical', pattern: /\bsk-(?!ant-)(?:proj-)?[A-Za-z0-9_-]{20,}\b/g },
+    { kind: 'Anthropic API key', severity: 'critical', pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g },
+    { kind: 'Stripe live key', severity: 'critical', pattern: /\b[rs]k_live_[A-Za-z0-9]{16,}\b/g },
+    { kind: 'Slack token', severity: 'critical', pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+    { kind: 'Google API key', severity: 'critical', pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+    { kind: 'Private key', severity: 'critical', pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g },
+    { kind: 'JSON Web Token', severity: 'high', pattern: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
+    {
+        kind: 'Payment card number',
+        severity: 'high',
+        pattern: /\b(?:\d[ -]?){13,19}\b/g,
+        confirm: (m) => {
+            const digits = m.replace(/[ -]/g, '');
+            return digits.length >= 13 && digits.length <= 19 && luhn(digits);
+        },
+    },
+    {
+        kind: 'Email address',
+        severity: 'medium',
+        pattern: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g,
+        // Placeholder addresses are all over prompts and docs; flagging them is
+        // exactly the noise that gets the whole feature switched off.
+        confirm: (m) => !/@(?:example|test|localhost|invalid|sample)\./i.test(m) && !/^(?:you|user|someone|name|email)@/i.test(m),
+    },
+];
+/**
+ * Assignment-shaped high-entropy strings, e.g. `api_key: "9f8a...".`
+ *
+ * Requires both a credential-ish name and genuinely random-looking content.
+ * Either signal alone produces far too much noise: prose has key-like words,
+ * and base64 blobs are often just data.
+ */
+const ASSIGNED = /\b([A-Za-z_][A-Za-z0-9_]*(?:key|token|secret|password|passwd|credential|auth)[A-Za-z0-9_]*)\b\s*[:=]\s*["']?([A-Za-z0-9+/_=-]{20,})["']?/gi;
+export function scan(text) {
+    const found = new Map();
+    const add = (kind, severity, value) => {
+        const existing = found.get(kind);
+        if (existing)
+            existing.count++;
+        else
+            found.set(kind, { kind, severity, preview: mask(value), count: 1 });
+    };
+    for (const rule of RULES) {
+        for (const match of text.matchAll(rule.pattern)) {
+            const value = match[0];
+            if (rule.confirm && !rule.confirm(value))
+                continue;
+            add(rule.kind, rule.severity, value);
+        }
+    }
+    for (const match of text.matchAll(ASSIGNED)) {
+        const value = match[2];
+        // 3.5 bits/char clears base64-encoded English but not a random key.
+        if (entropy(value) < 3.5)
+            continue;
+        // Skip anything a vendor rule already caught, to avoid double-reporting.
+        if (RULES.some((r) => r.kind !== 'Email address' && new RegExp(r.pattern.source).test(value)))
+            continue;
+        add(`High-entropy value in "${match[1]}"`, 'high', value);
+    }
+    return [...found.values()].sort((a, b) => ({ critical: 0, high: 1, medium: 2 })[a.severity] - ({ critical: 0, high: 1, medium: 2 })[b.severity]);
+}
+/** Walk a parsed request body and scan every string it contains. */
+export function scanRequest(body) {
+    const parts = [];
+    const walk = (node) => {
+        if (typeof node === 'string')
+            parts.push(node);
+        else if (Array.isArray(node))
+            node.forEach(walk);
+        else if (node && typeof node === 'object')
+            Object.values(node).forEach(walk);
+    };
+    walk(body);
+    return scan(parts.join('\n'));
+}

package/dist/server.d.ts

@@ -0,0 +1,8 @@
+import http from 'node:http';
+import type { Store } from './db.ts';
+import type { Controls } from './policy.ts';
+export interface ServerDeps {
+    store: Store;
+    controls: Controls;
+}
+export declare function createServer({ store, controls }: ServerDeps): http.Server;

package/dist/server.js

@@ -0,0 +1,193 @@
+import http from 'node:http';
+import { routeFor, forwardHeaders, redactHeaders } from "./providers.js";
+import { ResponseParser, parseRequest } from "./parse.js";
+import { filterBody, filterStream } from "./enforce.js";
+import { costUsd } from "./pricing.js";
+import { scanRequest } from "./secrets.js";
+import { renderViewer } from "./viewer.js";
+/** Response headers that must not be copied verbatim to the client. */
+const SKIP_RESPONSE_HEADERS = new Set(['content-encoding', 'content-length', 'transfer-encoding', 'connection']);
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        req.on('data', (c) => chunks.push(c));
+        req.on('end', () => resolve(Buffer.concat(chunks)));
+        req.on('error', reject);
+    });
+}
+function json(res, status, payload) {
+    const body = JSON.stringify(payload);
+    res.writeHead(status, { 'content-type': 'application/json', 'content-length': Buffer.byteLength(body) });
+    res.end(body);
+}
+export function createServer({ store, controls }) {
+    return http.createServer(async (req, res) => {
+        const url = req.url ?? '/';
+        if (url === '/' || url.startsWith('/_ambitry')) {
+            return handleControl(url, req, res, { store, controls });
+        }
+        const route = routeFor(url);
+        if (!route) {
+            return json(res, 404, {
+                error: 'Unknown path. Point your SDK at /anthropic or /openai.',
+                examples: ['http://localhost:8787/anthropic', 'http://localhost:8787/openai/v1'],
+            });
+        }
+        const body = await readBody(req);
+        const parsed = parseRequest(route.provider.id, body);
+        const requestJson = safeJson(body);
+        // Scanned on the way out, so a leak is caught on the request that carries
+        // it rather than after the provider has already received it.
+        const findings = scanRequest(requestJson);
+        // Checked before forwarding: a kill switch that only stops responses
+        // would still let the request bill and, worse, still let it act.
+        const gate = controls.checkRequest(store);
+        if (!gate.allowed) {
+            const id = store.beginTrace({
+                provider: route.provider.id,
+                path: url,
+                model: parsed.model,
+                streamed: parsed.stream,
+                request: { headers: redactHeaders(req.headers), body: requestJson },
+            });
+            store.recordFindings(id, findings);
+            store.finishTrace(id, { status: 403, error: gate.reason });
+            return json(res, 403, { type: 'error', error: { type: 'ambitry_blocked', message: gate.reason } });
+        }
+        const traceId = store.beginTrace({
+            provider: route.provider.id,
+            path: url,
+            model: parsed.model,
+            streamed: parsed.stream,
+            request: { headers: redactHeaders(req.headers), body: requestJson },
+        });
+        store.recordFindings(traceId, findings);
+        let upstream;
+        try {
+            upstream = await fetch(route.upstream, {
+                method: req.method,
+                headers: forwardHeaders(req.headers),
+                // Uint8Array rather than the Buffer itself: Buffer subclasses it, but
+                // fetch's BodyInit union does not name Buffer, so tsc rejects it.
+                body: ['GET', 'HEAD'].includes(req.method ?? 'GET') ? undefined : new Uint8Array(body),
+            });
+        }
+        catch (err) {
+            store.finishTrace(traceId, { error: `Upstream request failed: ${err.message}` });
+            return json(res, 502, { type: 'error', error: { type: 'ambitry_upstream', message: err.message } });
+        }
+        const headers = {};
+        upstream.headers.forEach((value, name) => {
+            if (!SKIP_RESPONSE_HEADERS.has(name.toLowerCase()))
+                headers[name] = value;
+        });
+        const parser = new ResponseParser(route.provider.id, parsed.stream);
+        // The central trade-off. With no rule that can reject anything there is
+        // nothing to withhold, so bytes stream straight through and the proxy
+        // adds no latency. Only when a deny rule exists do we buffer, because
+        // bytes already written to the client cannot be recalled.
+        if (!controls.enforcing) {
+            res.writeHead(upstream.status, headers);
+            if (upstream.body) {
+                for await (const chunk of upstream.body) {
+                    const buf = Buffer.from(chunk);
+                    parser.push(buf);
+                    res.write(buf);
+                }
+            }
+            res.end();
+            return record(store, controls, traceId, parser, upstream.status, []);
+        }
+        const chunks = [];
+        if (upstream.body) {
+            for await (const chunk of upstream.body) {
+                const buf = Buffer.from(chunk);
+                chunks.push(buf);
+                parser.push(buf);
+            }
+        }
+        const raw = Buffer.concat(chunks).toString('utf8');
+        const result = parser.finish();
+        const denials = [];
+        for (const call of result.toolCalls) {
+            const decision = controls.checkTool(call.name);
+            if (!decision.allowed)
+                denials.push({ index: call.index, name: call.name, reason: decision.reason });
+        }
+        const out = parsed.stream
+            ? filterStream(route.provider.id, raw, denials)
+            : filterBody(route.provider.id, raw, denials);
+        res.writeHead(upstream.status, headers);
+        res.end(out);
+        recordParsed(store, controls, traceId, result, upstream.status, denials);
+    });
+}
+function safeJson(body) {
+    try {
+        return JSON.parse(body.toString('utf8'));
+    }
+    catch {
+        return { raw: body.toString('utf8').slice(0, 10_000) };
+    }
+}
+function record(store, controls, id, parser, status, denials) {
+    recordParsed(store, controls, id, parser.finish(), status, denials);
+}
+function recordParsed(store, controls, id, result, status, denials) {
+    const denied = new Map(denials.map((d) => [d.index, d.reason]));
+    result.toolCalls.forEach((call, seq) => {
+        const reason = denied.get(call.index);
+        store.recordToolCall({
+            traceId: id,
+            seq,
+            name: call.name,
+            input: call.input,
+            decision: reason ? 'deny' : 'allow',
+            reason: reason ?? null,
+        });
+    });
+    store.finishTrace(id, {
+        status,
+        inputTokens: result.inputTokens,
+        outputTokens: result.outputTokens,
+        costUsd: costUsd(result.model, result.inputTokens, result.outputTokens),
+        response: { model: result.model, toolCalls: result.toolCalls },
+    });
+}
+function handleControl(url, req, res, { store, controls }) {
+    const path = url.split('?')[0];
+    if (path === '/' || path === '/_ambitry' || path === '/_ambitry/') {
+        const html = renderViewer();
+        res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
+        return res.end(html);
+    }
+    if (path === '/_ambitry/api/status') {
+        const now = Date.now();
+        return json(res, 200, {
+            killed: controls.isKilled,
+            enforcing: controls.enforcing,
+            limits: controls.limits,
+            spend: { lastHour: store.spendSince(now - 3_600_000), lastDay: store.spendSince(now - 86_400_000) },
+            findings: store.findingsSummary(now - 7 * 86_400_000),
+        });
+    }
+    if (path === '/_ambitry/api/traces') {
+        return json(res, 200, store.recentTraces(200));
+    }
+    const single = path.match(/^\/_ambitry\/api\/traces\/([\w-]+)$/);
+    if (single) {
+        const trace = store.trace(single[1]);
+        return trace
+            ? json(res, 200, { ...trace, findings: store.findingsFor(single[1]) })
+            : json(res, 404, { error: 'No such trace' });
+    }
+    if (path === '/_ambitry/api/kill' && req.method === 'POST') {
+        controls.kill('Stopped by kill switch');
+        return json(res, 200, { killed: true });
+    }
+    if (path === '/_ambitry/api/revive' && req.method === 'POST') {
+        controls.revive();
+        return json(res, 200, { killed: false });
+    }
+    return json(res, 404, { error: 'Unknown control endpoint' });
+}

package/dist/viewer.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The local dashboard, served from the proxy itself.
+ *
+ * One self-contained HTML string with no external requests — no CDN, no
+ * fonts, no analytics. A tool that reads your prompts has no business
+ * opening network connections you did not ask for, and "view source, it
+ * talks to nothing" is a claim anyone can check in a minute.
+ *
+ * Controls sit above traces on purpose: spend and the kill switch are what
+ * you leave running and glance at daily; the trace list is the evidence
+ * behind them.
+ */
+export declare function renderViewer(): string;

package/dist/viewer.js

@@ -0,0 +1,182 @@
+/**
+ * The local dashboard, served from the proxy itself.
+ *
+ * One self-contained HTML string with no external requests — no CDN, no
+ * fonts, no analytics. A tool that reads your prompts has no business
+ * opening network connections you did not ask for, and "view source, it
+ * talks to nothing" is a claim anyone can check in a minute.
+ *
+ * Controls sit above traces on purpose: spend and the kill switch are what
+ * you leave running and glance at daily; the trace list is the evidence
+ * behind them.
+ */
+export function renderViewer() {
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>ambitry</title>
+<style>
+  :root {
+    --bg: #fbfbfa; --panel: #fff; --line: #e4e4e1; --ink: #1a1a18;
+    --dim: #6b6b66; --accent: #2f6f4e; --deny: #b0342c; --warn: #b8721f;
+    color-scheme: light dark;
+  }
+  @media (prefers-color-scheme: dark) {
+    :root { --bg:#131313; --panel:#1a1a19; --line:#2e2e2c; --ink:#eceae5;
+            --dim:#94948d; --accent:#6fbf92; --deny:#e8776d; --warn:#dda54a; }
+  }
+  * { box-sizing: border-box; }
+  body { margin:0; background:var(--bg); color:var(--ink);
+         font:14px/1.5 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace; }
+  .wrap { max-width:940px; margin:0 auto; padding:24px 16px 64px; }
+  h1 { font-size:15px; letter-spacing:.14em; text-transform:uppercase; margin:0; color:var(--dim); font-weight:600; }
+  .head { display:flex; align-items:center; justify-content:space-between; gap:12px; margin-bottom:20px; }
+  .cards { display:grid; grid-template-columns:repeat(auto-fit,minmax(170px,1fr)); gap:10px; margin-bottom:22px; }
+  .card { background:var(--panel); border:1px solid var(--line); border-radius:8px; padding:12px 14px; }
+  .card .k { color:var(--dim); font-size:11px; letter-spacing:.09em; text-transform:uppercase; }
+  .card .v { font-size:22px; margin-top:4px; font-variant-numeric:tabular-nums; }
+  .bar { height:3px; background:var(--line); border-radius:2px; margin-top:8px; overflow:hidden; }
+  .bar i { display:block; height:100%; background:var(--accent); }
+  .bar.hot i { background:var(--warn); }
+  button { font:inherit; cursor:pointer; border-radius:6px; padding:7px 13px;
+           border:1px solid var(--line); background:var(--panel); color:var(--ink); }
+  button.kill { border-color:var(--deny); color:var(--deny); }
+  button.live { background:var(--deny); border-color:var(--deny); color:#fff; }
+  table { width:100%; border-collapse:collapse; background:var(--panel);
+          border:1px solid var(--line); border-radius:8px; overflow:hidden; }
+  th { text-align:left; font-size:11px; letter-spacing:.09em; text-transform:uppercase;
+       color:var(--dim); font-weight:600; padding:9px 12px; border-bottom:1px solid var(--line); }
+  td { padding:9px 12px; border-bottom:1px solid var(--line); vertical-align:top; }
+  tr:last-child td { border-bottom:0; }
+  tr.row { cursor:pointer; }
+  tr.row:hover td { background:color-mix(in srgb, var(--ink) 4%, transparent); }
+  .num { text-align:right; font-variant-numeric:tabular-nums; white-space:nowrap; }
+  .tag { display:inline-block; font-size:11px; padding:1px 7px; border-radius:99px;
+         border:1px solid currentColor; margin:1px 3px 1px 0; }
+  .ok { color:var(--accent); } .no { color:var(--deny); }
+  .alert { border:1px solid var(--deny); border-left-width:3px; border-radius:8px;
+           background:color-mix(in srgb, var(--deny) 7%, var(--panel));
+           padding:14px 16px; margin-bottom:22px; }
+  .alert h3 { margin:0 0 4px; font-size:14px; color:var(--deny); }
+  .alert p { margin:0 0 10px; color:var(--dim); font-size:13px; }
+  .alert .f { display:flex; justify-content:space-between; gap:12px;
+              padding:6px 0; border-top:1px solid var(--line); }
+  .alert .f:first-of-type { border-top:0; }
+  .alert .mono { color:var(--dim); font-size:12.5px; }
+  .empty { padding:40px 16px; text-align:center; color:var(--dim); }
+  .empty code { background:var(--panel); border:1px solid var(--line); padding:2px 6px; border-radius:4px; }
+  .detail { background:var(--panel); border:1px solid var(--line); border-radius:8px;
+            padding:14px; margin-top:12px; }
+  pre { margin:6px 0 0; padding:10px; background:var(--bg); border:1px solid var(--line);
+        border-radius:6px; overflow-x:auto; font-size:12px; }
+  .muted { color:var(--dim); }
+</style>
+</head>
+<body>
+<div class="wrap">
+  <div class="head">
+    <h1>ambitry</h1>
+    <button id="kill"></button>
+  </div>
+  <div id="alert"></div>
+  <div class="cards" id="cards"></div>
+  <div id="list"></div>
+  <div id="detail"></div>
+</div>
+<script>
+const $ = (id) => document.getElementById(id);
+const money = (n) => n == null ? '—' : '$' + Number(n).toFixed(n < 1 ? 4 : 2);
+const esc = (s) => String(s).replace(/[&<>]/g, (c) => ({'&':'&amp;','<':'&lt;','>':'&gt;'}[c]));
+
+function meter(label, spent, cap) {
+  const pct = cap ? Math.min(100, (spent / cap) * 100) : 0;
+  const bar = cap
+    ? '<div class="bar' + (pct > 80 ? ' hot' : '') + '"><i style="width:' + pct + '%"></i></div>'
+    : '<div class="k" style="margin-top:8px">no cap set</div>';
+  return '<div class="card"><div class="k">' + label + '</div><div class="v">' + money(spent) +
+    (cap ? ' <span class="muted" style="font-size:13px">/ ' + money(cap) + '</span>' : '') + '</div>' + bar + '</div>';
+}
+
+async function refresh() {
+  const [status, traces] = await Promise.all([
+    fetch('/_ambitry/api/status').then(r => r.json()),
+    fetch('/_ambitry/api/traces').then(r => r.json()),
+  ]);
+
+  const k = $('kill');
+  k.textContent = status.killed ? 'Agents stopped — resume' : 'Stop all agents';
+  k.className = status.killed ? 'live' : 'kill';
+
+  // The headline. What people came for is "am I leaking anything", and the
+  // answer belongs above the fold, not inside a trace nobody opens.
+  const f = status.findings || [];
+  $('alert').innerHTML = !f.length ? '' :
+    '<div class="alert"><h3>' + f.reduce((n, x) => n + x.occurrences, 0) +
+    ' credential' + (f.reduce((n, x) => n + x.occurrences, 0) === 1 ? '' : 's') +
+    ' sent to your model provider</h3>' +
+    '<p>Found in outgoing prompts over the last 7 days. The finding keeps only a masked preview — ' +
+    'but the prompt itself is in your local trace file, so treat that file as sensitive.</p>' +
+    f.map(x => '<div class="f"><span>' + esc(x.kind) + ' <span class="mono">' + esc(x.preview) + '</span></span>' +
+      '<span class="mono">' + x.occurrences + '× in ' + x.traces + ' request' + (x.traces === 1 ? '' : 's') +
+      '</span></div>').join('') + '</div>';
+
+  const blocked = traces.filter(t => t.status === 403).length;
+  $('cards').innerHTML =
+    meter('Spend · last hour', status.spend.lastHour, status.limits.perHourUsd) +
+    meter('Spend · last day', status.spend.lastDay, status.limits.perDayUsd) +
+    '<div class="card"><div class="k">Requests</div><div class="v">' + traces.length + '</div>' +
+      '<div class="k" style="margin-top:8px">' + (status.enforcing ? 'policy enforcing' : 'logging only') + '</div></div>' +
+    '<div class="card"><div class="k">Blocked</div><div class="v">' + blocked + '</div>' +
+      '<div class="k" style="margin-top:8px">by policy</div></div>';
+
+  if (!traces.length) {
+    $('list').innerHTML = '<div class="empty">No traffic yet. Point your SDK at ' +
+      '<code>http://localhost:' + location.port + '/anthropic</code> and run your agent.</div>';
+    return;
+  }
+
+  $('list').innerHTML = '<table><thead><tr><th>Time</th><th>Model</th><th>Tools</th>' +
+    '<th class="num">Tokens</th><th class="num">Cost</th></tr></thead><tbody>' +
+    traces.map(t => '<tr class="row" data-id="' + t.id + '">' +
+      '<td>' + new Date(t.started_at).toLocaleTimeString() +
+        (t.status === 403 ? ' <span class="tag no">blocked</span>' : '') + '</td>' +
+      '<td>' + esc(t.model || '—') + '</td>' +
+      '<td class="muted">' + (t.streamed ? 'stream' : '') + '</td>' +
+      '<td class="num">' + ((t.input_tokens ?? 0) + (t.output_tokens ?? 0) || '—') + '</td>' +
+      '<td class="num">' + money(t.cost_usd) + '</td></tr>').join('') +
+    '</tbody></table>';
+
+  document.querySelectorAll('tr.row').forEach(r =>
+    r.onclick = () => showTrace(r.dataset.id));
+}
+
+async function showTrace(id) {
+  const { trace, toolCalls } = await fetch('/_ambitry/api/traces/' + id).then(r => r.json());
+  const calls = toolCalls.length
+    ? toolCalls.map(c => '<div style="margin-top:10px">' +
+        '<span class="tag ' + (c.decision === 'deny' ? 'no' : 'ok') + '">' + c.decision + '</span>' +
+        '<strong>' + esc(c.name) + '</strong>' +
+        (c.reason ? ' <span class="muted">— ' + esc(c.reason) + '</span>' : '') +
+        '<pre>' + esc(JSON.stringify(JSON.parse(c.input_json), null, 2)) + '</pre></div>').join('')
+    : '<div class="muted" style="margin-top:8px">No tool calls in this turn.</div>';
+
+  $('detail').innerHTML = '<div class="detail"><div class="k muted">' + esc(trace.provider) +
+    ' · ' + esc(trace.path) + (trace.error ? ' · <span class="no">' + esc(trace.error) + '</span>' : '') +
+    '</div>' + calls + '</div>';
+  $('detail').scrollIntoView({ behavior: 'smooth', block: 'nearest' });
+}
+
+$('kill').onclick = async () => {
+  const status = await fetch('/_ambitry/api/status').then(r => r.json());
+  await fetch('/_ambitry/api/' + (status.killed ? 'revive' : 'kill'), { method: 'POST' });
+  refresh();
+};
+
+refresh();
+setInterval(refresh, 2000);
+</script>
+</body>
+</html>`;
+}

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "ambitry",
+  "version": "0.1.0",
+  "description": "Audit log and permission layer for AI agents. One-line integration, zero runtime dependencies.",
+  "type": "module",
+  "bin": {
+    "ambitry": "dist/cli.js"
+  },
+  "main": "dist/index.js",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "node --experimental-strip-types src/cli.ts",
+    "test": "node --experimental-strip-types --test test/*.test.ts",
+    "prepublishOnly": "cp ../../README.md ../../LICENSE . && npm run build"
+  },
+  "keywords": [
+    "ai",
+    "agents",
+    "audit",
+    "proxy",
+    "observability",
+    "security",
+    "llm"
+  ],
+  "license": "Apache-2.0",
+  "engines": {
+    "node": ">=24"
+  },
+  "devDependencies": {
+    "typescript": "^5.7.0",
+    "@types/node": "^22.10.0"
+  }
+}